Big change for authentication, which now supports more SASL mechanisms and

callbacks.  This should address issues SMACK-210 and SMACK-142, as well as 
set the stage for SMACK-234. 



git-svn-id: http://svn.igniterealtime.org/svn/repos/smack/trunk@9498 b35dd754-fafc-0310-a699-88a17e54d16e

source/org/jivesoftware/smack/sasl/SASLAnonymous.java

@@ -3,7 +3,6 @@
  * $Revision: $
  * $Date: $
  *
- * Copyright 2003-2005 Jive Software.
  *
  * All rights reserved. Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -22,12 +21,13 @@ package org.jivesoftware.smack.sasl;
 
 import org.jivesoftware.smack.SASLAuthentication;
 
+import java.io.IOException;
+import javax.security.auth.callback.CallbackHandler;
+
 /**
- * Implementation of the SASL ANONYMOUS mechanisn as defined by the
- * <a href="http://www.ietf.org/internet-drafts/draft-ietf-sasl-anon-05.txt">IETF draft
- * document</a>.
+ * Implementation of the SASL ANONYMOUS mechanism
  *
- * @author Gaston Dombiak
+ * @author Jay Kline
  */
 public class SASLAnonymous extends SASLMechanism {
 
@@ -39,14 +39,34 @@ public class SASLAnonymous extends SASLMechanism {
         return "ANONYMOUS";
     }
 
-    protected String getAuthenticationText(String username, String host, String password) {
-        // Nothing to send in the <auth> body
-        return null;
+    public void authenticate(String username, String host, CallbackHandler cbh) throws IOException {
+        authenticate();
     }
 
-    protected String getChallengeResponse(byte[] bytes) {
-        // Some servers may send a challenge to gather more information such as
-        // email address. Return any string value.
-        return "anything";
+    public void authenticate(String username, String host, String password) throws IOException {
+        authenticate();
     }
+
+    protected void authenticate() throws IOException {
+        StringBuffer stanza = new StringBuffer();
+        stanza.append("<auth mechanism=\"").append(getName());
+        stanza.append("\" xmlns=\"urn:ietf:params:xml:ns:xmpp-sasl\">");
+        stanza.append("</auth>");
+
+        // Send the authentication to the server
+        getSASLAuthentication().send(stanza.toString());
+    }
+
+    public void challengeReceived(String challenge) throws IOException {
+        // Build the challenge response stanza encoding the response text
+        StringBuffer stanza = new StringBuffer();
+        stanza.append("<response xmlns=\"urn:ietf:params:xml:ns:xmpp-sasl\">");
+        stanza.append("=");
+        stanza.append("</response>");
+
+        // Send the authentication to the server
+        getSASLAuthentication().send(stanza.toString());
+    }
+
+
 }

source/org/jivesoftware/smack/sasl/SASLCramMD5Mechanism.java

@@ -0,0 +1,38 @@
+/**
+ * $RCSfile$
+ * $Revision: $
+ * $Date: $
+ *
+ *
+ * All rights reserved. Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.jivesoftware.smack.sasl;
+
+import org.jivesoftware.smack.SASLAuthentication;
+
+/**
+ * Implementation of the SASL CRAM-MD5 mechanism
+ *
+ * @author Jay Kline
+ */
+public class SASLCramMD5Mechanism extends SASLMechanism {
+
+    public SASLCramMD5Mechanism(SASLAuthentication saslAuthentication) {
+        super(saslAuthentication);
+    }
+
+    protected String getName() {
+        return "CRAM-MD5";
+    }
+}

source/org/jivesoftware/smack/sasl/SASLDigestMD5Mechanism.java

@@ -0,0 +1,38 @@
+/**
+ * $RCSfile$
+ * $Revision: $
+ * $Date: $
+ *
+ *
+ * All rights reserved. Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.jivesoftware.smack.sasl;
+
+import org.jivesoftware.smack.SASLAuthentication;
+
+/**
+ * Implementation of the SASL DIGEST-MD5 mechanism
+ *
+ * @author Jay Kline
+ */
+public class SASLDigestMD5Mechanism extends SASLMechanism {
+
+    public SASLDigestMD5Mechanism(SASLAuthentication saslAuthentication) {
+        super(saslAuthentication);
+    }
+
+    protected String getName() {
+        return "CRAM-MD5";
+    }
+}

source/org/jivesoftware/smack/sasl/SASLExternalMechanism.java

@@ -0,0 +1,59 @@
+/**
+ * $RCSfile$
+ * $Revision: $
+ * $Date: $
+ *
+ *
+ * All rights reserved. Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.jivesoftware.smack.sasl;
+
+import org.jivesoftware.smack.SASLAuthentication;
+
+/**
+ * Implementation of the SASL EXTERNAL mechanism.
+ *
+ * To effectively use this mechanism, Java must be configured to properly 
+ * supply a client SSL certificate (of some sort) to the server. It is up
+ * to the implementer to determine how to do this.  Here is one method:
+ *
+ * Create a java keystore with your SSL certificate in it:
+ * keytool -genkey -alias username -dname "cn=username,ou=organizationalUnit,o=organizationaName,l=locality,s=state,c=country"
+ *
+ * Next, set the System Properties:
+ *  <ul>
+ *  <li>javax.net.ssl.keyStore to the location of the keyStore
+ *  <li>javax.net.ssl.keyStorePassword to the password of the keyStore
+ *  <li>javax.net.ssl.trustStore to the location of the trustStore
+ *  <li>javax.net.ssl.trustStorePassword to the the password of the trustStore
+ *  </ul>
+ *
+ * Then, when the server requests or requires the client certificate, java will
+ * simply provide the one in the keyStore.
+ *
+ * Also worth noting is the EXTERNAL mechanism in Smack is not enabled by default.
+ * To enable it, the implementer will need to call SASLAuthentication.supportSASLMechamism("EXTERNAL");
+ *
+ * @author Jay Kline
+ */
+public class SASLExternalMechanism extends SASLMechanism  {
+
+    public SASLExternalMechanism(SASLAuthentication saslAuthentication) {
+        super(saslAuthentication);
+    }
+
+    protected String getName() {
+        return "EXTERNAL";
+    }
+}

source/org/jivesoftware/smack/sasl/SASLGSSAPIMechanism.java

@@ -19,29 +19,26 @@
 
 package org.jivesoftware.smack.sasl;
 
-import javax.security.sasl.*;
-import java.util.*;
-import java.io.IOException;
-
 import org.jivesoftware.smack.SASLAuthentication;
-import org.jivesoftware.smack.util.Base64;
+import org.jivesoftware.smack.XMPPException;
+
+import java.io.IOException;
+import java.util.Map;
+import java.util.HashMap;
+import javax.security.sasl.Sasl;
+import javax.security.sasl.SaslClient;
+import javax.security.auth.callback.CallbackHandler;
 
 /**
- * Implementation of the SASL GSSAPI mechanisn
- * 
+ * Implementation of the SASL GSSAPI mechanism
  *
  * @author Jay Kline
  */
 public class SASLGSSAPIMechanism extends SASLMechanism {
 
-    private static final String protocol = "xmpp";
-    private static final String[] mechanisms = {"GSSAPI"};    
-    private SaslClient sc;
-
     public SASLGSSAPIMechanism(SASLAuthentication saslAuthentication) {
         super(saslAuthentication);
-        
-        System.setProperty("java.security.krb5.debug","true");
+
         System.setProperty("javax.security.auth.useSubjectCredsOnly","false");
         System.setProperty("java.security.auth.login.config","gss.conf");
 
@@ -59,71 +56,35 @@ public class SASLGSSAPIMechanism extends SASLMechanism {
      *
      * @param username the username of the user being authenticated.
      * @param host     the hostname where the user account resides.
-     * @param password the password of the user (ignored for GSSAPI)
+     * @param cbh      the CallbackHandler (not used with GSSAPI)
      * @throws IOException If a network error occures while authenticating.
      */
-    public void authenticate(String username, String host, String password) throws IOException {
-        // Build the authentication stanza encoding the authentication text
-        StringBuffer stanza = new StringBuffer();
+    public void authenticate(String username, String host, CallbackHandler cbh) throws IOException, XMPPException {
+        String[] mechanisms = { getName() };
         Map props = new HashMap();
-	
-        sc = Sasl.createSaslClient(mechanisms, username, protocol, host, props, null);
-
-	stanza.append("<auth mechanism=\"").append(getName());
-        stanza.append("\" xmlns=\"urn:ietf:params:xml:ns:xmpp-sasl\">");
-        if(sc.hasInitialResponse()) {
-            byte[] response = sc.evaluateChallenge(new byte[0]);
-            String authenticationText = Base64.encodeBytes(response,Base64.DONT_BREAK_LINES);
-            if(authenticationText != null && !authenticationText.equals("")) {
-                stanza.append(authenticationText);
-            }
-        }
-        stanza.append("</auth>");
-
-        // Send the authentication to the server
-        getSASLAuthentication().send(stanza.toString());
-    }
-
-
-    protected String getAuthenticationText(String username, String host, String password) {
-        // Unused, see authenticate
-        return null;
+        props.put(Sasl.SERVER_AUTH,"TRUE");
+        sc = Sasl.createSaslClient(mechanisms, username, "xmpp", host, props, cbh);
+        authenticate();
     }
 
     /**
-     * The server is challenging the SASL mechanism for the stanza he just sent. Send a
-     * response to the server's challenge. This overrieds from the abstract class because the
-     * tokens needed for GSSAPI are binary, and not safe to put in a string, thus 
-     * getChallengeResponse() cannot be used.
+     * Builds and sends the <tt>auth</tt> stanza to the server.
+     * This overrides from the abstract class because the initial token
+     * needed for GSSAPI is binary, and not safe to put in a string, thus
+     * getAuthenticationText() cannot be used.
      *
-     * @param challenge a base64 encoded string representing the challenge.
+     * @param username the username of the user being authenticated.
+     * @param host     the hostname where the user account resides.
+     * @param password the password of the user (ignored for GSSAPI)
+     * @throws IOException If a network error occures while authenticating.
      */
-    public void challengeReceived(String challenge) throws IOException {
-        // Build the challenge response stanza encoding the response text
-        StringBuffer stanza = new StringBuffer();
-
-        byte response[];
-        if(challenge != null) {
-            response = sc.evaluateChallenge(Base64.decode(challenge));
-        } else {
-            response = sc.evaluateChallenge(null);
-        }
-
-        String authenticationText = Base64.encodeBytes(response,Base64.DONT_BREAK_LINES);
-        if(authenticationText.equals("")) {
-            authenticationText = "=";
-        }
-
-        stanza.append("<response xmlns=\"urn:ietf:params:xml:ns:xmpp-sasl\">");
-        stanza.append(authenticationText);
-        stanza.append("</response>");
-
-        // Send the authentication to the server
-        getSASLAuthentication().send(stanza.toString());
+    public void authenticate(String username, String host, String password) throws IOException, XMPPException {
+        String[] mechanisms = { getName() };
+        Map props = new HashMap();
+        props.put(Sasl.SERVER_AUTH,"TRUE");
+        sc = Sasl.createSaslClient(mechanisms, username, "xmpp", host, props, this);
+        authenticate();
     }
 
-    protected String getChallengeResponse(byte[] bytes) {
-        // Unused, see challengeReceived
-        return null;
-    }
+
 }

source/org/jivesoftware/smack/sasl/SASLMechanism.java

@@ -20,47 +20,107 @@
 
 package org.jivesoftware.smack.sasl;
 
+import org.jivesoftware.smack.XMPPException;
 import org.jivesoftware.smack.SASLAuthentication;
-import org.jivesoftware.smack.util.StringUtils;
+import org.jivesoftware.smack.util.Base64;
 
 import java.io.IOException;
+import java.util.Map;
+import java.util.HashMap;
+import javax.security.auth.callback.CallbackHandler;
+import javax.security.auth.callback.UnsupportedCallbackException;
+import javax.security.auth.callback.Callback;
+import javax.security.auth.callback.NameCallback;
+import javax.security.auth.callback.PasswordCallback;
+import javax.security.sasl.RealmCallback;
+import javax.security.sasl.RealmChoiceCallback;
+import javax.security.sasl.Sasl;
+import javax.security.sasl.SaslClient;
+import javax.security.sasl.SaslException;
 
 /**
- * Base class for SASL mechanisms. Subclasses must implement three methods:
+ * Base class for SASL mechanisms. Subclasses must implement these methods:
  * <ul>
  *  <li>{@link #getName()} -- returns the common name of the SASL mechanism.</li>
- *  <li>{@link #getAuthenticationText(String, String, String)} -- authentication text to include
- *      in the initial <tt>auth</tt> stanza.</li>
- *  <li>{@link #getChallengeResponse(byte[])} -- to respond challenges made by the server.</li>
+ * </ul>
+ * Subclasses will likely want to implement their own versions of these mthods:
+ *  <li>{@link #authenticate(String, String, String)} -- Initiate authentication stanza using the
+ *  deprecated method.</li>
+ *  <li>{@link #authenticate(String, String, CallbackHandler)} -- Initiate authentication stanza
+ *  using the CallbackHandler method.</li>
+ *  <li>{@link #challengeReceived(String)} -- Handle a challenge from the server.</li>
  * </ul>
  *
- * @author Gaston Dombiak
+ * @author Jay Kline
  */
-public abstract class SASLMechanism {
+public abstract class SASLMechanism implements CallbackHandler {
 
     private SASLAuthentication saslAuthentication;
+    protected SaslClient sc;
+    protected String authenticationId;
+    protected String password;
+
 
     public SASLMechanism(SASLAuthentication saslAuthentication) {
-        super();
         this.saslAuthentication = saslAuthentication;
     }
 
     /**
-     * Builds and sends the <tt>auth</tt> stanza to the server.
+     * Builds and sends the <tt>auth</tt> stanza to the server. Note that this method of
+     * authentication is not recommended, since it is very inflexable.  Use
+     * {@link #authenticate(String, String, CallbackHandler)} whenever possible.
      *
      * @param username the username of the user being authenticated.
      * @param host     the hostname where the user account resides.
-     * @param password the password of the user.
-     * @throws IOException If a network error occures while authenticating.
+     * @param password the password for this account.
+     * @throws IOException If a network error occurs while authenticating.
+     * @throws XMPPException If a protocol error occurs or the user is not authenticated.
      */
-    public void authenticate(String username, String host, String password) throws IOException {
-        // Build the authentication stanza encoding the authentication text
-        StringBuilder stanza = new StringBuilder();
+    public void authenticate(String username, String host, String password) throws IOException, XMPPException {
+        //Since we were not provided with a CallbackHandler, we will use our own with the given
+        //information
+
+        //Set the authenticationID as the username, since they must be the same in this case.
+        this.authenticationId = username;
+        this.password = password;
+
+        String[] mechanisms = { getName() };
+        Map<String,String> props = new HashMap<String,String>();
+        sc = Sasl.createSaslClient(mechanisms, username, "xmpp", host, props, this);
+        authenticate();
+    }
+
+    /**
+     * Builds and sends the <tt>auth</tt> stanza to the server. The callback handler will handle
+     * any additional information, such as the authentication ID or realm, if it is needed.
+     *
+     * @param username the username of the user being authenticated.
+     * @param host     the hostname where the user account resides.
+     * @param cbh      the CallbackHandler to obtain user information.
+     * @throws IOException If a network error occures while authenticating.
+     * @throws XMPPException If a protocol error occurs or the user is not authenticated.
+     */
+    public void authenticate(String username, String host, CallbackHandler cbh) throws IOException, XMPPException {
+        String[] mechanisms = { getName() };
+        Map<String,String> props = new HashMap<String,String>();
+        sc = Sasl.createSaslClient(mechanisms, username, "xmpp", host, props, cbh);
+        authenticate();
+    }
+
+    protected void authenticate() throws IOException, XMPPException {
+        StringBuffer stanza = new StringBuffer();
         stanza.append("<auth mechanism=\"").append(getName());
         stanza.append("\" xmlns=\"urn:ietf:params:xml:ns:xmpp-sasl\">");
-        String authenticationText = getAuthenticationText(username, host, password);
-        if (authenticationText != null) {
-            stanza.append(StringUtils.encodeBase64(authenticationText));
+        try {
+            if(sc.hasInitialResponse()) {
+                byte[] response = sc.evaluateChallenge(new byte[0]);
+                String authenticationText = Base64.encodeBytes(response,Base64.DONT_BREAK_LINES);
+                if(authenticationText != null && !authenticationText.equals("")) {
+                    stanza.append(authenticationText);
+                }
+            }
+        } catch (SaslException e) {
+            throw new XMPPException("SASL authentication failed", e);
         }
         stanza.append("</auth>");
 
@@ -68,6 +128,7 @@ public abstract class SASLMechanism {
         getSASLAuthentication().send(stanza.toString());
     }
 
+
     /**
      * The server is challenging the SASL mechanism for the stanza he just sent. Send a
      * response to the server's challenge.
@@ -77,12 +138,22 @@ public abstract class SASLMechanism {
      */
     public void challengeReceived(String challenge) throws IOException {
         // Build the challenge response stanza encoding the response text
-        StringBuilder stanza = new StringBuilder();
-        stanza.append("<response xmlns=\"urn:ietf:params:xml:ns:xmpp-sasl\">");
-        String authenticationText = getChallengeResponse(StringUtils.decodeBase64(challenge));
-        if (authenticationText != null) {
-            stanza.append(StringUtils.encodeBase64(authenticationText));
+        StringBuffer stanza = new StringBuffer();
+
+        byte response[];
+        if(challenge != null) {
+            response = sc.evaluateChallenge(Base64.decode(challenge));
+        } else {
+            response = sc.evaluateChallenge(null);
         }
+
+        String authenticationText = Base64.encodeBytes(response,Base64.DONT_BREAK_LINES);
+        if(authenticationText.equals("")) {
+            authenticationText = "=";
+        }
+
+        stanza.append("<response xmlns=\"urn:ietf:params:xml:ns:xmpp-sasl\">");
+        stanza.append(authenticationText);
         stanza.append("</response>");
 
         // Send the authentication to the server
@@ -90,34 +161,37 @@ public abstract class SASLMechanism {
     }
 
     /**
-     * Returns the response text to send answering the challenge sent by the server. Mechanisms
-     * that will never receive a challenge may redefine this method returning <tt>null</tt>.
-     *
-     * @param bytes the challenge sent by the server.
-     * @return the response text to send to answer the challenge sent by the server.
-     */
-    protected abstract String getChallengeResponse(byte[] bytes);
-
-    /**
-     * Returns the common name of the SASL mechanism. E.g.: PLAIN, DIGEST-MD5 or KERBEROS_V4.
+     * Returns the common name of the SASL mechanism. E.g.: PLAIN, DIGEST-MD5 or GSSAPI.
      *
      * @return the common name of the SASL mechanism.
      */
     protected abstract String getName();
 
-    /**
-     * Returns the authentication text to include in the initial <tt>auth</tt> stanza
-     * or <tt>null</tt> if nothing should be added.
-     *
-     * @param username the username of the user being authenticated.
-     * @param host     the hostname where the user account resides.
-     * @param password the password of the user.
-     * @return the authentication text to include in the initial <tt>auth</tt> stanza
-     *         or <tt>null</tt> if nothing should be added.
-     */
-    protected abstract String getAuthenticationText(String username, String host, String password);
 
     protected SASLAuthentication getSASLAuthentication() {
         return saslAuthentication;
     }
+
+    /**
+     * 
+     */
+    public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
+        for (int i = 0; i < callbacks.length; i++) {
+            if (callbacks[i] instanceof NameCallback) {
+                NameCallback ncb = (NameCallback)callbacks[i];
+                ncb.setName(authenticationId);
+            } else if(callbacks[i] instanceof PasswordCallback) {
+                PasswordCallback pcb = (PasswordCallback)callbacks[i];
+                pcb.setPassword(password.toCharArray());
+            } else if(callbacks[i] instanceof RealmCallback) {
+                //unused
+                //RealmCallback rcb = (RealmCallback)callbacks[i];
+            } else if(callbacks[i] instanceof RealmChoiceCallback){
+                //unused
+                //RealmChoiceCallback rccb = (RealmChoiceCallback)callbacks[i];
+            } else {
+               throw new UnsupportedCallbackException(callbacks[i]);
+            }
+         }
+    }
 }

source/org/jivesoftware/smack/sasl/SASLPlainMechanism.java

@@ -1,5 +1,4 @@
 /**
- * Copyright 2003-2007 Jive Software.
  *
  * All rights reserved. Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -19,11 +18,9 @@ package org.jivesoftware.smack.sasl;
 import org.jivesoftware.smack.SASLAuthentication;
 
 /**
- * Implementation of the SASL PLAIN mechanisn as defined by the
- * <a href="http://www.ietf.org/internet-drafts/draft-ietf-sasl-plain-08.txt">IETF draft
- * document</a>.
+ * Implementation of the SASL PLAIN mechanism
  *
- * @author Gaston Dombiak
+ * @author Jay Kline
  */
 public class SASLPlainMechanism extends SASLMechanism {
 
@@ -34,23 +31,4 @@ public class SASLPlainMechanism extends SASLMechanism {
     protected String getName() {
         return "PLAIN";
     }
-
-    protected String getAuthenticationText(String username, String host, String password) {
-        // Build the text containing the "authorization identity" + NUL char +
-        // "authentication identity" + NUL char + "clear-text password"
-        StringBuilder text = new StringBuilder();
-        // Commented out line below due to SMACK-224. This part of PLAIN auth seems to be
-        // optional, and just removing it should increase compatability.  
-//         text.append(username).append("@").append(host);
-        text.append('\0');
-        text.append(username);
-        text.append('\0');
-        text.append(password);
-        return text.toString();
-    }
-
-    protected String getChallengeResponse(byte[] bytes) {
-        // Return null since this mechanism will never get a challenge from the server
-        return null;
-    }
 }